My search looks like below:
index=foo search_name="bar" |stats sum(Count) AS Total
Sometimes Total doesn't have any value and is NULL. Is there a way this NULL can be replaced with 0?
I tried below two but none worked.
Any help is greatly appreciated.
Thanks for your reply but when I try to use, it still doesn't show any results... Don't I expect to see "0" incase there are no results in "Total" after using this fillnull function?
Reading through the documentation:
"Null values are those missing in a particular result, but present for some other result."
In my case there is only one value instead of multiple events with some having values and others NULL. How do we replace NULL with 0 in case of only one value?
When I try your search, on an index with no
Count fields, I don't get one result with a null. Instead I get no results. Whereas, you instead want to get one result with a zero.
I think this will do what you want:
search_name=not_found | append [ search * | head 1 | eval Count=0 ] | stats sum(Count) AS Total
This will always give you a total count unless there are no rows that match your selected time frame. It's a bit awkward, though.
Yeah the problem is it shows no results when there are no matching events. I want to show "0" in Total in that case.
Above doesn't work as field Count won't even exist if there are no matched events.
Basically I want to say if Total contains nothing, just display 0.